Backups, Passwords, and the Bad Day
The five unglamorous habits that decide whether a stolen laptop or hacked account is an annoyance or a disaster.
Nobody calls us about security when things are fine. They call the week after: a laptop died with the only copy of the books on it, an email account got hijacked and started messaging customers, an employee left and nobody remembers what they had access to.
Here is the honest truth about small business security: you do not need enterprise tools or a consultant on retainer. You need five unglamorous habits, set up once and maintained barely at all. They decide whether your bad day is an annoyance or a disaster.
The Five Habits
Backups that happen without you. if your files live only on one computer, you are one spilled coffee from losing them. Turn on automatic cloud backup for every machine that matters and for your key systems. The test is simple: could you lose any single device today and be working again tomorrow? If the answer is no, this is priority one.
A password manager for the whole team. reused passwords are how small businesses actually get breached. One leaked password from some unrelated website gets tried against your email, your bank, your software. A password manager makes every login unique without anyone memorizing anything, and it means departing employees hand back access instead of taking it with them.
Two-factor authentication on the accounts that matter. email, banking, accounting, and anywhere customer data lives. Yes, the extra code is mildly annoying. It is also the single cheapest thing that stops most account takeovers cold. Start with email, because whoever controls your email can reset everything else.
A list of who can access what. not software, just a list. Every system, every person, what level of access. Review it when someone joins, leaves, or changes roles. Most businesses that skip this discover ex-employees with live logins years later, not from malice, just from nobody owning the list.
A plan for the bad day. one page. If a laptop is lost: what gets locked, in what order. If email is compromised: who changes what, who tells customers. If the main computer dies: where the backup is and who restores it. Writing this down takes an evening. Improvising it during the actual emergency takes a week and costs sleep.
The Email Trap Worth Naming
One threat deserves its own paragraph because it works so often: the fake invoice or urgent payment request. Someone emails your bookkeeper pretending to be you, or pretending to be a supplier with new bank details. The fix is not software, it is a rule: any request to send money or change payment details gets confirmed through a second channel, a phone call or a face-to-face, every time, no matter how legitimate the email looks. Make this a standing rule and say it out loud to whoever touches money.
What You Can Skip
You will be sold a lot in this category. For a typical small business, you do not need a dedicated firewall appliance, a threat intelligence subscription, or dark web monitoring. The built-in protections in modern operating systems and the habits above cover the realistic risks. Spend the money you save on making sure the backups actually run.
An Afternoon, Honestly
Everything above fits in an afternoon plus a little follow-through: an hour for backups, an hour to roll out a password manager, an hour for two-factor, an evening for the list and the plan. It is the least exciting work in this business and some of the most valuable. If you want a second set of hands to set it up and verify it actually works, that is a short engagement, not a project.
Ready to talk?
Want help positioning your brand?
Book a free discovery call. No pitch, no pressure. Just an honest conversation about where you are and what you’re trying to build.
Book a Free Discovery Call